list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.
CVSS Details
- CVSS 3.1 Base Score: 4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libarchiveUpgrade libarchive-develUpgrade bsdtar | Jul 1, 2025 | Mar 2, 2025 |
| Alpine Linux | — | Upgrade libarchive | Aug 8, 2025 | Mar 2, 2025 |
| Debian | — | No solution exists | May 15, 2025 | Mar 2, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libarchive | Jul 11, 2025 | Mar 2, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libarchive | Jun 13, 2025 | Mar 2, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libarchive | Jun 11, 2025 | Mar 2, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libarchive | Jul 1, 2025 | Mar 2, 2025 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Dec 15, 2025 |
| Oracle_linux | — | Upgrade bsdtarUpgrade libarchive-develUpgrade libarchive | Jun 30, 2025 | Mar 2, 2025 |
| Redhat_linux | — | Upgrade libarchive-debuginfoUpgrade bsdcat-debuginfoUpgrade bsdunzip-debuginfoUpgrade libarchiveUpgrade bsdtar-debuginfoUpgrade bsdcpio-debuginfoUpgrade bsdtarUpgrade libarchive-debugsourceNo solution existsUpgrade libarchive-devel | Jun 26, 2025 | Mar 2, 2025 |
| Rocky_linux | — | Upgrade libarchive-develUpgrade bsdtarUpgrade libarchiveUpgrade libarchive-debuginfoUpgrade libarchive-debugsourceUpgrade bsdtar-debuginfo | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade bsdtarUpgrade libarchive13-32bitUpgrade libarchive13Upgrade libarchive-devel | Dec 5, 2025 | Jun 26, 2025 |
| Ubuntu | — | Upgrade libarchive13Upgrade libarchive-toolsUpgrade libarchive-tools (Ubuntu Pro)Upgrade bsdtar (Ubuntu Pro)Upgrade libarchive-devUpgrade libarchive-dev (Ubuntu Pro)Upgrade libarchive13 (Ubuntu Pro)Upgrade libarchive13t64Upgrade bsdcpio (Ubuntu Pro) | Apr 24, 2025 | Mar 2, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 2, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub